@cosmicdrift/kumiko-framework 0.327.0 → 0.328.0

package/src/db/queries/backfill-pii.ts

@@ -37,8 +37,8 @@
 //   Both stages are opt-in and off by default; without them an unresolvable
 //   subject still fails loud into `failures`, as before.
 //
-// Snapshots of touched aggregates are dropped (they may cache plaintext);
-// the next snapshotting load recreates them. AFTER a run, rebuild the
+// Snapshots of touched aggregates are dropped per batch (they may cache
+// plaintext); the next snapshotting load recreates them. AFTER a run, rebuild the
 // affected projections — applyEntityEvent materializes ciphertext AND the
 // blind-index columns, which keeps equality lookups (login by email) alive.
 
@@ -50,6 +50,7 @@ import {
   KeyErasedError,
   KeyNotFoundError,
   type KmsContext,
+  type LocalKeyKmsAdapter,
   type SubjectId,
 } from "../../crypto/kms-adapter";
 import {
@@ -67,7 +68,7 @@ import {
 import type { EntityDefinition, Registry, TenantId } from "../../engine/types";
 import type { DbRunner } from "../connection";
 import { resolveTableName } from "../entity-table-meta";
-import { isUndefinedTable } from "../pg-error";
+import { tableExists } from "../schema-inspection";
 import { toSnakeCase } from "../table-builder";
 
 const LIFECYCLE_VERBS = ["created", "updated", "deleted", "restored", "forgotten"] as const;
@@ -92,6 +93,19 @@ export type PiiBackfillResult = {
   readonly failures: readonly PiiBackfillFailure[];
 };
 
+export type PiiBackfillScanCache = {
+  forgottenAggregates?: ReadonlySet<string>;
+};
+
+export type PiiBackfillBatchResult = PiiBackfillResult & {
+  // Last scanned event id; null when the batch was empty.
+  readonly lastEventId: string | null;
+  readonly scannedAll: boolean;
+  readonly firstFailedEventId: string | null;
+  readonly touchedAggregateTypes: readonly string[];
+  readonly touchedEventTypes: readonly string[];
+};
+
 export type PiiBackfillOptions = {
   readonly batchSize?: number;
   // Scan + count only, write nothing — including the subject KMS: outcomes
@@ -105,6 +119,12 @@ export type PiiBackfillOptions = {
   readonly eraseUnresolvableSubjects?: boolean;
 };
 
+export type PiiBackfillBatchOptions = PiiBackfillOptions & {
+  readonly afterEventId?: bigint | string;
+  // Caller-held so the forgotten-set full scan is shared across batches.
+  readonly scanCache?: PiiBackfillScanCache;
+};
+
 type EventRow = {
   readonly id: bigint | string;
   readonly aggregate_id: string;
@@ -116,36 +136,94 @@ type EventRow = {
 
 type FieldOutcome = "unchanged" | "encrypted" | "erased";
 
-export async function backfillEventPiiEncryption(
-  db: DbRunner,
-  registry: Registry,
-  options: PiiBackfillOptions = {},
-): Promise<PiiBackfillResult> {
+type PiiTargets = {
+  readonly entityTargets: ReadonlyMap<
+    string,
+    { readonly entity: EntityDefinition; readonly piiFields: readonly string[] }
+  >;
+  readonly eventCatalog: ReturnType<typeof configuredEventPiiCatalog>;
+};
+
+function collectPiiTargets(registry: Registry): PiiTargets {
+  const entityTargets = new Map<
+    string,
+    { readonly entity: EntityDefinition; readonly piiFields: readonly string[] }
+  >();
+  for (const [name, entity] of registry.getAllEntities()) {
+    const piiFields = collectPiiSubjectFields(entity);
+    if (piiFields.length > 0) entityTargets.set(name, { entity, piiFields });
+  }
+  return { entityTargets, eventCatalog: configuredEventPiiCatalog() };
+}
+
+function requireLocalKeySubjectKms(caller: string): LocalKeyKmsAdapter {
   const kms = configuredPiiSubjectKms();
   if (!kms) {
     throw new Error(
-      "backfillEventPiiEncryption requires a configured subject KMS — boot with " +
+      `${caller} requires a configured subject KMS — boot with ` +
         "runProdApp({ kms }) / configurePiiSubjectKms(adapter) before running the backfill.",
     );
   }
   if (!isLocalKeyKmsAdapter(kms)) {
-    throw new Error("backfillEventPiiEncryption requires a local-key KMS adapter");
+    throw new Error(`${caller} requires a local-key KMS adapter`);
   }
-  const subjectKms = kms;
+  return kms;
+}
+
+export async function backfillEventPiiEncryption(
+  db: DbRunner,
+  registry: Registry,
+  options: PiiBackfillOptions = {},
+): Promise<PiiBackfillResult> {
+  requireLocalKeySubjectKms("backfillEventPiiEncryption");
+  const total = {
+    scannedEvents: 0,
+    updatedEvents: 0,
+    encryptedFields: 0,
+    erasedFields: 0,
+    ownerFromProjection: 0,
+    erasedUnresolvable: 0,
+    deletedSnapshots: 0,
+  };
+  const failures: PiiBackfillFailure[] = [];
+  const scanCache: PiiBackfillScanCache = {};
+  let afterEventId: string = "0";
+
+  for (;;) {
+    const batch = await backfillEventPiiEncryptionBatch(db, registry, {
+      ...options,
+      afterEventId,
+      scanCache,
+    });
+    total.scannedEvents += batch.scannedEvents;
+    total.updatedEvents += batch.updatedEvents;
+    total.encryptedFields += batch.encryptedFields;
+    total.erasedFields += batch.erasedFields;
+    total.ownerFromProjection += batch.ownerFromProjection;
+    total.erasedUnresolvable += batch.erasedUnresolvable;
+    total.deletedSnapshots += batch.deletedSnapshots;
+    failures.push(...batch.failures);
+    if (batch.lastEventId === null || batch.scannedAll) break;
+    afterEventId = batch.lastEventId;
+  }
+  return { ...total, failures };
+}
+
+// Processes exactly one batch. Snapshots of the batch's touched aggregates are
+// dropped inside the same call so an abort between batches never leaves a
+// snapshot that caches plaintext for an already-encrypted stream.
+export async function backfillEventPiiEncryptionBatch(
+  db: DbRunner,
+  registry: Registry,
+  options: PiiBackfillBatchOptions = {},
+): Promise<PiiBackfillBatchResult> {
+  const subjectKms = requireLocalKeySubjectKms("backfillEventPiiEncryptionBatch");
   const batchSize = options.batchSize ?? 500;
   const raw = asRawClient(db);
   const kmsCtx: KmsContext = { requestId: "pii-backfill" };
+  const scanCache = options.scanCache ?? {};
 
-  const entityTargets = new Map<
-    string,
-    { readonly entity: EntityDefinition; readonly piiFields: readonly string[] }
-  >();
-  for (const [name, entity] of registry.getAllEntities()) {
-    const piiFields = collectPiiSubjectFields(entity);
-    if (piiFields.length > 0) entityTargets.set(name, { entity, piiFields });
-  }
-  const eventCatalog = configuredEventPiiCatalog();
-
+  const { entityTargets, eventCatalog } = collectPiiTargets(registry);
   const aggregateTypes = [...entityTargets.keys()];
   const catalogTypes = [...eventCatalog.keys()];
   const result = {
@@ -158,65 +236,65 @@ export async function backfillEventPiiEncryption(
     deletedSnapshots: 0,
     failures: [] as PiiBackfillFailure[],
   };
-  if (aggregateTypes.length === 0 && catalogTypes.length === 0) return result;
-
-  // Pre-KMS forgets left no key tombstone — the *.forgotten event on the
-  // stream is the only durable marker. Collect once; aggregate_id doubles
-  // as the user id for user-subject lookups.
-  const forgottenRows = (await raw.unsafe(
-    `SELECT DISTINCT "aggregate_id" FROM "kumiko_events" WHERE "type" LIKE '%.forgotten'`,
-  )) as ReadonlyArray<{ aggregate_id: string }>;
-  const forgottenAggregates = new Set(forgottenRows.map((r) => r.aggregate_id));
-
+  const emptyBatch = (): PiiBackfillBatchResult => ({
+    ...result,
+    lastEventId: null,
+    scannedAll: true,
+    firstFailedEventId: null,
+    touchedAggregateTypes: [],
+    touchedEventTypes: [],
+  });
+  if (aggregateTypes.length === 0 && catalogTypes.length === 0) return emptyBatch();
+
+  const rows = (await raw.unsafe(
+    `SELECT "id", "aggregate_id", "aggregate_type", "tenant_id", "type", "payload"
+       FROM "kumiko_events"
+      WHERE ("aggregate_type" = ANY($1::text[]) OR "type" = ANY($2::text[])) AND "id" > $3::bigint
+      ORDER BY "id" ASC
+      LIMIT $4`,
+    [aggregateTypes, catalogTypes, String(options.afterEventId ?? 0), batchSize],
+  )) as ReadonlyArray<EventRow>;
+  const last = rows[rows.length - 1];
+  if (last === undefined) return emptyBatch();
+
+  const projectionOwnersByType = await loadProjectionOwners(rows);
   const touchedAggregates = new Set<string>();
-  let cursor = "0";
-
-  for (;;) {
-    const rows = (await raw.unsafe(
-      `SELECT "id", "aggregate_id", "aggregate_type", "tenant_id", "type", "payload"
-         FROM "kumiko_events"
-        WHERE ("aggregate_type" = ANY($1::text[]) OR "type" = ANY($2::text[])) AND "id" > $3::bigint
-        ORDER BY "id" ASC
-        LIMIT $4`,
-      [aggregateTypes, catalogTypes, cursor, batchSize],
-    )) as ReadonlyArray<EventRow>;
-    if (rows.length === 0) break;
-
-    const projectionOwnersByType = await loadProjectionOwners(rows);
-
-    for (const row of rows) {
-      result.scannedEvents++;
-      try {
-        const outcome = await transformEvent(row, projectionOwnersByType.get(row.aggregate_type));
-        if (outcome === null) continue;
-        result.encryptedFields += outcome.encrypted;
-        result.erasedFields += outcome.erased;
-        result.ownerFromProjection += outcome.ownerFromProjection;
-        result.erasedUnresolvable += outcome.erasedUnresolvable;
-        if (!options.dryRun) {
-          await raw.unsafe(`UPDATE "kumiko_events" SET "payload" = $1::jsonb WHERE "id" = $2`, [
-            outcome.payload,
-            row.id,
-          ]);
-        }
-        result.updatedEvents++;
-        touchedAggregates.add(row.aggregate_id);
-      } catch (e) {
-        const reason = e instanceof Error ? e.message : String(e);
-        result.failures.push({
-          eventId: String(row.id),
-          reason:
-            e instanceof SubjectResolutionError
-              ? `${reason} (retry with { resolveOwnerFromProjection: true } to resolve the owner ` +
-                "from the entity's projection table, and/or { eraseUnresolvableSubjects: true } to " +
-                "erase fields whose subject stays unresolvable)"
-              : reason,
-        });
+  const touchedAggregateTypes = new Set<string>();
+  const touchedEventTypes = new Set<string>();
+  let firstFailedEventId: string | null = null;
+
+  for (const row of rows) {
+    result.scannedEvents++;
+    try {
+      const outcome = await transformEvent(row, projectionOwnersByType.get(row.aggregate_type));
+      if (outcome === null) continue;
+      result.encryptedFields += outcome.encrypted;
+      result.erasedFields += outcome.erased;
+      result.ownerFromProjection += outcome.ownerFromProjection;
+      result.erasedUnresolvable += outcome.erasedUnresolvable;
+      if (!options.dryRun) {
+        await raw.unsafe(`UPDATE "kumiko_events" SET "payload" = $1::jsonb WHERE "id" = $2`, [
+          outcome.payload,
+          row.id,
+        ]);
       }
+      result.updatedEvents++;
+      touchedAggregates.add(row.aggregate_id);
+      touchedAggregateTypes.add(row.aggregate_type);
+      touchedEventTypes.add(row.type);
+    } catch (e) {
+      const reason = e instanceof Error ? e.message : String(e);
+      firstFailedEventId ??= String(row.id);
+      result.failures.push({
+        eventId: String(row.id),
+        reason:
+          e instanceof SubjectResolutionError
+            ? `${reason} (retry with { resolveOwnerFromProjection: true } to resolve the owner ` +
+              "from the entity's projection table, and/or { eraseUnresolvableSubjects: true } to " +
+              "erase fields whose subject stays unresolvable)"
+            : reason,
+      });
     }
-    const last = rows[rows.length - 1];
-    if (last === undefined) break;
-    cursor = String(last.id);
   }
 
   // Snapshots may cache the plaintext state of touched aggregates.
@@ -228,7 +306,28 @@ export async function backfillEventPiiEncryption(
     result.deletedSnapshots = deleted.length;
   }
 
-  return result;
+  return {
+    ...result,
+    lastEventId: String(last.id),
+    scannedAll: rows.length < batchSize,
+    firstFailedEventId,
+    touchedAggregateTypes: [...touchedAggregateTypes],
+    touchedEventTypes: [...touchedEventTypes],
+  };
+
+  // Full-scan of the store — only paid once a plaintext field actually needs
+  // encrypting, so a catch-up run over already-encrypted events never runs it.
+  async function loadForgottenAggregates(): Promise<ReadonlySet<string>> {
+    if (scanCache.forgottenAggregates) return scanCache.forgottenAggregates;
+    // Pre-KMS forgets left no key tombstone — the *.forgotten event on the
+    // stream is the only durable marker. aggregate_id doubles as the user id
+    // for user-subject lookups.
+    const forgottenRows = (await raw.unsafe(
+      `SELECT DISTINCT "aggregate_id" FROM "kumiko_events" WHERE "type" LIKE '%.forgotten'`,
+    )) as ReadonlyArray<{ aggregate_id: string }>;
+    scanCache.forgottenAggregates = new Set(forgottenRows.map((r) => r.aggregate_id));
+    return scanCache.forgottenAggregates;
+  }
 
   async function loadProjectionOwners(
     rows: readonly EventRow[],
@@ -249,7 +348,10 @@ export async function backfillEventPiiEncryption(
       if (!target) continue;
       const tableName = resolveTableName(aggregateType, target.entity, undefined);
       const ownersById = new Map<string, Record<string, unknown>>();
-      try {
+      // Existence check instead of catching undefined_table: a caught SQL error
+      // aborts the surrounding transaction (25P02). Entity never mounted/rebuilt
+      // → stage 3 still gets a chance; this batch just contributes no owners.
+      if (await tableExists(db, `public.${tableName}`)) {
         const projectionRows = (await raw.unsafe(
           `SELECT * FROM ${quoteIdent(tableName)} WHERE "id" = ANY($1::uuid[])`,
           [[...ids]],
@@ -260,10 +362,6 @@ export async function backfillEventPiiEncryption(
             ownersById.set(id, projectionRowToCamel(target.entity, projectionRow));
           }
         }
-      } catch (e) {
-        // Entity never mounted/rebuilt (no projection table yet) — stage 3
-        // still gets a chance; this batch just contributes no owners.
-        if (!isUndefinedTable(e)) throw e;
       }
       byType.set(aggregateType, ownersById);
     }
@@ -367,7 +465,7 @@ export async function backfillEventPiiEncryption(
       if (value === null || value === undefined) return "unchanged";
       if (typeof value !== "string") return "unchanged";
       if (isPiiCiphertext(value) || value === PII_ERASED_SENTINEL) return "unchanged";
-      if (isForgottenSubject(subject, row.aggregate_id)) {
+      if (await isForgottenSubject(subject, row.aggregate_id)) {
         section[field] = PII_ERASED_SENTINEL;
         return "erased";
       }
@@ -400,7 +498,8 @@ export async function backfillEventPiiEncryption(
     }
   }
 
-  function isForgottenSubject(subject: SubjectId, aggregateId: string): boolean {
+  async function isForgottenSubject(subject: SubjectId, aggregateId: string): Promise<boolean> {
+    const forgottenAggregates = await loadForgottenAggregates();
     if (forgottenAggregates.has(aggregateId)) return true;
     return subject.kind === "user" && forgottenAggregates.has(subject.userId);
   }

package/src/db/queries/pii-backfill-state.ts

@@ -0,0 +1,33 @@
+import type { AnyDb } from "../query";
+import { asRawClient } from "../query";
+
+export type PiiBackfillStateRow = { readonly cursor: string; readonly completed: boolean };
+
+export async function readPiiBackfillState(
+  db: AnyDb,
+  fingerprint: string,
+): Promise<PiiBackfillStateRow | null> {
+  const rows = (await asRawClient(db).unsafe(
+    `SELECT "cursor_event_id"::text AS "cursor", "completed_at" IS NOT NULL AS "completed"
+       FROM "kumiko_pii_backfill_state" WHERE "fingerprint" = $1`,
+    [fingerprint],
+  )) as ReadonlyArray<PiiBackfillStateRow>;
+  return rows[0] ?? null;
+}
+
+export async function persistPiiBackfillState(
+  db: AnyDb,
+  fingerprint: string,
+  cursor: bigint,
+  markCompleted: boolean,
+): Promise<void> {
+  await asRawClient(db).unsafe(
+    `INSERT INTO "kumiko_pii_backfill_state" ("fingerprint", "cursor_event_id", "completed_at", "updated_at")
+     VALUES ($1, $2::bigint, CASE WHEN $3::boolean THEN now() ELSE NULL END, now())
+     ON CONFLICT ("fingerprint") DO UPDATE SET
+       "cursor_event_id" = GREATEST("kumiko_pii_backfill_state"."cursor_event_id", EXCLUDED."cursor_event_id"),
+       "completed_at" = COALESCE("kumiko_pii_backfill_state"."completed_at", EXCLUDED."completed_at"),
+       "updated_at" = now()`,
+    [fingerprint, cursor.toString(), markCompleted],
+  );
+}

package/src/engine/__tests__/build-app-schema.test.ts

@@ -392,6 +392,32 @@ describe("buildAppSchema", () => {
     expect(fields["categories"]?.["maxRows"]).toBeUndefined();
   });
 
+  test("Select: optionTones überleben die Projection", () => {
+    const entity = {
+      fields: {
+        status: {
+          type: "select",
+          options: ["open", "closed"],
+          optionTones: { closed: "bad" },
+        },
+        area: { type: "select", options: ["a", "b"] },
+      },
+    } as unknown as EntityDefinition;
+
+    const f = defineFeature("ent", (r) => {
+      r.entity("thing", entity);
+    });
+    const app = buildAppSchema(createRegistry([f]));
+    const fields = (
+      app.features[0]!.entities["thing"] as unknown as {
+        fields: Record<string, Record<string, unknown>>;
+      }
+    ).fields;
+
+    expect(fields["status"]?.["optionTones"]).toEqual({ closed: "bad" });
+    expect(fields["area"]?.["optionTones"]).toBeUndefined();
+  });
+
   test("MultiSelectFieldDef: alle Keys sind in projectField bewusst eingeordnet", () => {
     // Bounded completeness check, scoped to MultiSelectFieldDef's own key set
     // (packages/types/src/fields.ts) — NOT a general FieldDefinition lockstep.

package/src/engine/build-app-schema.ts

@@ -450,6 +450,8 @@ function projectField(fieldDef: FieldDefinition): FieldDefinition {
   if (isJsonSafeValue(def["default"])) out["default"] = def["default"];
   // Select: options-Liste ist plain JSON, durchschicken.
   if (Array.isArray(def["options"])) out["options"] = def["options"];
+  if (isPlainObject(def["optionTones"]) && isJsonSafeValue(def["optionTones"]))
+    out["optionTones"] = def["optionTones"];
   // Reference: entity-Target + labelField + multiple müssen zum Renderer.
   // Der ReferenceInput baut die Options-Query aus refEntity/refFeature und
   // resolved das Label über labelField — ohne diese Properties fällt das

package/src/engine/types/index.ts

@@ -143,6 +143,7 @@ export type {
   ResolvedPiiFlags,
   RetentionDef,
   SelectFieldDef,
+  SelectOptionTone,
   TextFieldDef,
   TimestampFieldDef,
   TransitionMap,

package/src/event-store/index.ts

@@ -1,8 +1,12 @@
 export {
   backfillEventPiiEncryption,
+  backfillEventPiiEncryptionBatch,
+  type PiiBackfillBatchOptions,
+  type PiiBackfillBatchResult,
   type PiiBackfillFailure,
   type PiiBackfillOptions,
   type PiiBackfillResult,
+  type PiiBackfillScanCache,
 } from "../db/queries/backfill-pii";
 export {
   type ArchiveStreamArgs,

package/src/i18n/required-surface-keys.ts

@@ -166,6 +166,8 @@ export function requiredKeysFromScreen(
           out.add(fieldLabelKey(featureName, list.entity, normalized.field));
         }
       }
+      pushKey(out, list.createLabel);
+      pushKey(out, list.searchPlaceholder);
       for (const action of list.rowActions ?? []) pushRowActionKeys(out, action);
       for (const action of list.toolbarActions ?? []) pushToolbarActionKeys(out, action);
       break;
@@ -177,6 +179,8 @@ export function requiredKeysFromScreen(
         const normalized = normalizeListColumn(col);
         if (normalized.label !== undefined) pushKey(out, normalized.label);
       }
+      pushKey(out, list.createLabel);
+      pushKey(out, list.searchPlaceholder);
       for (const action of list.rowActions ?? []) pushRowActionKeys(out, action);
       for (const action of list.toolbarActions ?? []) pushToolbarActionKeys(out, action);
       break;
@@ -207,6 +211,8 @@ export function requiredKeysFromScreen(
     case "actionForm": {
       const form = screen as ActionFormScreenDefinition;
       pushKey(out, form.submitLabel);
+      pushKey(out, form.summary?.title);
+      pushKey(out, form.summary?.subtitle);
       for (const fieldName of Object.keys(form.fields)) {
         const override = form.fieldLabels?.[fieldName];
         if (override !== undefined) pushKey(out, override);
@@ -318,6 +324,8 @@ export function requiredKeysFromScreen(
         }
         if (section.kind === "relatedList") {
           pushKey(out, section.title);
+          pushKey(out, section.description);
+          pushKey(out, section.itemNoun);
           for (const col of section.columns) {
             const normalized = normalizeListColumn(col);
             if (normalized.label !== undefined) pushKey(out, normalized.label);

package/src/migrations/__tests__/pending-rebuilds.integration.test.ts

@@ -6,7 +6,7 @@ import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:tes
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { integer, table as pgTable, uuid } from "../../db/dialect";
+import { integer, table as pgTable, text, uuid } from "../../db/dialect";
 import { createEventStoreExecutor } from "../../db/event-store-executor";
 import { asRawClient, selectMany } from "../../db/query";
 import { writeRebuildMarker } from "../../db/rebuild-marker";
@@ -21,7 +21,7 @@ import {
   type ProjectionDefinition,
 } from "../../engine";
 import type { JobRunner } from "../../jobs/job-runner";
-import { createProjectionStateTable } from "../../pipeline";
+import { createEventConsumerStateTable, createProjectionStateTable } from "../../pipeline";
 import {
   createTestDb,
   type TestDb,
@@ -54,6 +54,12 @@ const countsTable = pgTable("read_pending_counts", {
   itemCount: integer("item_count").notNull().default(0),
 });
 
+const mspItemNamesTable = pgTable("read_pending_msp_names", {
+  id: uuid("id").primaryKey(),
+  tenantId: uuid("tenant_id").notNull(),
+  name: text("name"),
+});
+
 // Exists in the DB but has no registered projection — models an owning
 // feature missing from the composition (distinct from a deliberately DROPped
 // table, which is never pushed at all).
@@ -83,6 +89,20 @@ const countsProjection: ProjectionDefinition = {
 const feature = defineFeature("pendingtest", (r) => {
   r.entity("pending-item", itemEntity);
   r.projection(countsProjection);
+  r.multiStreamProjection({
+    name: "pending-item-names",
+    table: mspItemNamesTable,
+    apply: {
+      "pending-item.created": async (event, tx) => {
+        const payload = event.payload as { name: string };
+        await asRawClient(tx).unsafe(
+          `INSERT INTO "read_pending_msp_names" (id, tenant_id, name) VALUES ($1::uuid, $2::uuid, $3)
+           ON CONFLICT (id) DO UPDATE SET name = EXCLUDED.name`,
+          [event.aggregateId, event.tenantId, payload.name],
+        );
+      },
+    },
+  });
 });
 
 const admin = TestUsers.admin;
@@ -97,9 +117,11 @@ beforeAll(async () => {
   testDb = await createTestDb();
   await unsafeCreateEntityTable(testDb.db, itemEntity, "pending-item");
   await createProjectionStateTable(testDb.db);
+  await createEventConsumerStateTable(testDb.db);
   await unsafePushTables(testDb.db, {
     readPendingCounts: countsTable,
     readOrphanProjection: orphanProjectionTable,
+    readPendingMspNames: mspItemNamesTable,
   });
   tdb = createTenantDb(testDb.db, admin.tenantId);
   markerDir = mkdtempSync(join(tmpdir(), "pending-rebuilds-"));
@@ -113,7 +135,7 @@ afterAll(async () => {
 beforeEach(async () => {
   failApply = false;
   await asRawClient(testDb.db).unsafe(
-    `TRUNCATE kumiko_events, read_pending_items, read_pending_counts, read_orphan_projection, kumiko_projections RESTART IDENTITY CASCADE`,
+    `TRUNCATE kumiko_events, read_pending_items, read_pending_counts, read_orphan_projection, read_pending_msp_names, kumiko_projections RESTART IDENTITY CASCADE`,
   );
   await asRawClient(testDb.db).unsafe(`DROP TABLE IF EXISTS kumiko_pending_rebuilds`);
 });
@@ -160,6 +182,26 @@ describe("pending-rebuilds queue", () => {
     expect(await getCount()).toBe(2);
   });
 
+  test("a queued multi-stream projection table is rebuilt through the multi-stream path", async () => {
+    await executor.create({ groupId: GROUP, name: "a" }, admin, tdb);
+    await executor.create({ groupId: GROUP, name: "b" }, admin, tdb);
+    writeRebuildMarker(markerDir, "0003_msp.sql", ["read_pending_msp_names"]);
+    await queueRebuildsFromMarkers(testDb.db, {
+      migrationsDir: markerDir,
+      appliedIds: ["0003_msp"],
+    });
+
+    const run = await runPendingRebuilds(testDb.db, registry);
+
+    expect(run.failed).toEqual([]);
+    expect(run.rebuilt).toEqual([
+      { projection: "pendingtest:projection:pending-item-names", eventsProcessed: 2 },
+    ]);
+    expect(await listPendingRebuilds(testDb.db)).toEqual([]);
+    const rows = await selectMany(testDb.db, mspItemNamesTable);
+    expect(rows.map((r) => r.name).sort()).toEqual(["a", "b"]);
+  });
+
   test("tables without a registered projection are drained, not stuck forever", async () => {
     writeRebuildMarker(markerDir, "0002_unmapped.sql", ["read_some_plain_table"]);
     await queueRebuildsFromMarkers(testDb.db, {